k3s cluster with agent (or server?) in cloud

[sardaukar]

Hello.

I've recently installed a k3s cluster with the server set to a machine in my house, and an agent on a VPS. Before installing k3s on both, I installed Tailscale with my own control server running Headscale.

So when it came to install k3s, I used --flannel-iface=tailscale0 and all is well, for HTTP (non-TLS) requests.

Problem is I want some services to be reachable on my tailnet only, but some to be public as well. Right now, I have nginx listening on both en0 and tailscale0 on the VPS and forwarding those requests to the IP traefik is running on inside the cluster, but I have to manage certificates with certbot on the VPS, as I couldn't get cert-manager to answer to challenges in the cluster.

Is there a way I could skip nginx on the VPS and just have k3s listening on both tailscale0 and en0? Do I need two deployments of Traefik for this to work?

Thanks for any pointers in advance.